KR19990082957A - Fault tolerant control system - Google Patents

Abstract

The present invention provides a fault tolerant control system that includes a plurality of redundant sensors disposed within a power plant to provide information about substantially identical primary and secondary programmable logic control systems. control system). Normal operation of the control system is not affected by any obvious single faults in the control system. In operation, output from the first control system to the field device is stopped only when a health signal indicates that the first control system is not functioning.

Description

Fault-tolerant control system {FAULT TOLERANT CONTROL SYSTEM}

The present invention relates to a control system capable of withstanding defects used in nuclear power plants. More specifically, the present invention relates to a control system hardware device for use as a water supply control system, reactor control system, or steam assist control system, which can operate despite any apparent single defects in the system.

Nuclear steam plants have traditionally been equipped with automatic controls for the reactor regulating system (RRS), feed-water control system (FWCS), and steam bypass control system (SBCS). Use an integrated system. Such control systems for nuclear power plants have been known for many years and may be implemented with process computers. The process computer receives information from a nuclear reactor through sensors and signal conditioners. Through a series of mathematical processes on the detected information, the control system automatically generates an output signal that is applied to the operating system or control device and subsequently changes the operation of the reactor. For example, the RRS may require a change in core reactivity of the reactor based on information derived from previous core sensors.

Due to the control system, the majority of the actual control of the nuclear power plant is automated. The dependence on nuclear power process computers has gradually increased due to improved availability, efficiency, and safety, all of which have been significantly improved with the use of digital process computers. The newer design of the power plant process computer incorporates the concept of a functional modular level of hardware, simplifying the ratification and modification of the control system. The system helps to overcome the increased complexity of power plants required to maximize availability and still meet stringent safety and environmental requirements.

Modular control systems such as RRS, FWCS, and SBCS operate effectively when all components function properly. However, when one component becomes defective due to illogical or other factors, complex transients are created where one or more power plant boundary conditions misrepresent. This transient is difficult to control due to the complexity of the control system and the interaction of various controls based on shared control system parameters. If the control system fails, the plant operation is usually switched to manual control, which may not prevent the control system or even shut down the plant.

Moreover, in the past few years, the cost of nuclear power plant construction has increased as well as operating costs. As a result, nuclear plant operators are responsible for improving plant performance, including minimizing downtime due to system failures. In order to maximize cost efficiency, power plant designs have increased in size and complexity with the accompanying regulation and control system requirements. However, as complexity increased, the likelihood of defects in individual components adversely affecting plant operation also increased. Moreover, alteration and maintenance of a plant control system usually requires that the system be shut down, causing other degradation of plant performance.

Accordingly, it is an object of the present invention to overcome the aforementioned disadvantages of defects or maintenance of control system components by providing a control system capable of withstanding defects for nuclear power plant systems such as RRS, FWCS, and SBCS. The term "tolerable to defects" is to be understood that the normal operation of the control system is not affected by any certain single fault within the control system.

It is still another object of the present invention to provide a control system capable of withstanding defects that minimize the downtime of nuclear power plants due to component defects.

It is another object of the present invention to provide a control system capable of withstanding defects such that normal operation of the control system is not affected during maintenance of the system.

In accordance with the present invention, a control system is provided that is capable of withstanding defects including a number of redundant sensors disposed within a nuclear power plant for providing information to the same first and second programmable logic control systems. During normal operation both the first and second control systems supply parallel digital outputs to the field device. At least the health status of the first control system is continuously monitored. Under normal conditions, the field device receives the output from the first control system. In a preferred embodiment, the output from the first control system is stopped only when the state of health indicates that the first control system is not functioning. When the output of the first control system is interrupted, the output of the second control system is input to the power plant field device for continuous control.

The present invention is designed to substantially eliminate system defects caused by certain single point defects in the system. The invention also substantially eliminates ancillary systems or plant outages resulting from a common single point factor. The object of the invention is achieved because a single point of defect in the control system is substantially eliminated. As a result, the present invention provides high system availability and protects against the operation of the system backing up in the event of a single component failure. If the first system fails to function, the output from the first control system is interrupted to prevent the wrong output signal from passing through the field device. However, the output from the second control system, which is the same as the output from the healthy first control system, is sent to the field device. Since both the first and second systems operate continuously, control is transferred in a smooth manner that does not affect the plant process. In this way, the control task is automatically transferred from the first control processor to the second control processor upon detection of a defect in the first unit.

The features and inventive aspects of the present invention will become more apparent upon reading the accompanying drawings, the following detailed description, claims, and brief description.

1 is an analog configuration diagram of a fault tolerant control system capable of withstanding the general faults of the present invention.

1A is a digital schematic diagram of a control system capable of withstanding the general deficiencies of the present invention.

2 is an analog configuration diagram of a control system capable of withstanding the deficiencies of the present invention in an integrated system of automatic control for a reactor control system, a water supply control system, and a steam assist control system.

2A is a digital diagram of a control system capable of withstanding the deficiencies of FIG.

3 is an exemplary flow diagram of a control system capable of withstanding the deficiencies of the present invention in an analog configuration diagram.

3A is an exemplary flow diagram of a control system capable of withstanding the deficiencies of the present invention in a digital schematic diagram.

<Explanation of symbols for the main parts of the drawings>

10: control system 12,13: first and second control system

22,82: control circuit 25: field device

40,60: first and second control system 46,66: processing function

48,68: output function 50,70: health monitoring function

80: field process 90,92: selection circuit

A control system capable of withstanding the defects according to the invention is shown schematically in FIG. 1. As used herein, the term "fault tolerant" is understood to mean that the normal operation of the control system is not affected by any obvious single fault within the control system. .

In FIG. 1, the control system 10 according to the invention generally comprises a first control system 12, for backup purposes or a second control system 13. Both the first control system 12 and the second control system 13 receive input data from the common sensor 14. However, input data from the sensor 14 is passed via separate first and second isolators 15 and 16, respectively. Isolators 15 and 16 serve to prevent overvoltage or feedback situations between the sensor 14 and the control system. The data from the isolators 15 and 16 are then passed to separate first and second input modules (not shown) that supply the data to the control system. The information supplied from the input module to the control systems 12 and 13 may be generated by sensors in the plant function or by outputs from other control systems in the plant. Existing plant designs use redundant sensors strategically placed within the nuclear power plant system, so that in the event that one sensor fails to function, the control system will need to retrieve data from the redundant sensors to continue normal plant functions. To use.

In the same way, the present invention provides redundant process control in the form of a first control system 12 and a second control system 13. Both systems receive the same input information. Moreover, both the first system 12 and the second system 13 are completely identical. As a result, under normal operating conditions the first output 19 is substantially the same as the second output 20. Outputs 19 and 20 pass through output isolators 17 and 18. In the schematic diagram of an analog control system of the type shown in FIG. 1, a steering circuit 22 is provided for selectively transmitting output data 24 to a field device or other power plant location 25.

In the control system configuration diagram that can withstand digital defects, shown schematically in FIG. 1A, the first and second control systems 12 and 13 provide both field devices 25 with the same output in a substantially parallel relationship. . It does not matter whether the output driving the field device 25 is from the first control system 12 or from the second control system 13 and the control system shown in FIG. Only if it receives a defect (many defects) will it be functional. Removing either the first control system 12 or the second control system 13 does not affect the function of the field device 25.

Since the control systems 12 and 13 are substantially identical, the initial choice of one as the first control system and one as the second control system is at will. However, once designated as the first control system, a control system capable of withstanding the deficiencies of the present invention is configured such that the first control system preferentially controls the field device as in FIG. Thus, in the analog configuration diagram of FIG. 1, once the control system 12 is designated as the first control system, by default the steering circuit 22 outputs the output data 19 from the first control system 12. Pass through the output data 24. Only if the first control system 12 fails anyway, the second output 20 will pass through to the output data 24. In the case of the digital schematic diagram of FIG. 1A, the first control system is considered to drive the field device 25 because the outputs from the first and second control systems 12 and 13 are substantially the same. However, as previously pointed out, a defect in either the first control system 12 or the second control system 13 does not affect the field device 25.

An integrated system of automatic control systems for a nuclear power plant system is shown in both FIG. 2 and FIG. 2A. In particular, an integrated control system for the reactor control system 26, RRS, water supply control systems 28, 30, FWCS for each steam generator, and steam auxiliary control systems 32, 34, SBCS is shown. All control systems illustrate a system capable of withstanding defects as described above with reference to FIG. 1. Thus, each system in FIG. 2 includes a first control system and a fully functional, fully redundant second control system. In FIG. 2, each pair of identical control systems further includes a steering circuit 22 for selectively transferring output data from the fault-free, functioning control system to another power plant location (not shown). In FIG. 2A, each pair of identical control systems is configured to transmit outputs from the first and second control systems to other power plant locations.

The characteristics that can withstand the intact defects of the analog schematic of the control system of the present invention are better explained with reference to FIG. The same two control systems 40, 60 are arranged in parallel to process the information flowing from the power plant sensors X and Y and also to provide the output data to the field processing 80. In FIG. 3, the control system 40 is arbitrarily defined as the first control system, while the control system 60 is defined as the second control system. A number of redundant sensors X and Y are located in the power plant to provide information to the control system 40, 60. Integrated control systems of the type that control RRS, FWCS and SBCS require data from multiple points within the reactor system. However, in Fig. 3 all system internal sensors are designated as sensors X and Y.

The data from the sensors X and Y are then sent to the first control system 40 and the second control system 60 via the same single separate isolator (not shown) and input modules 42 and 62. Is received by. Data received by input modules 42 and 62 is received by processing functions 46 and 66. Processing functions 46 and 66 perform the same pre-programmed processing steps on the data according to the requirements of the automatically controlled power plant system. Based on the input data, processing functions 46 and 66 allow output functions 48 and 68 to be transmitted to field devices to maintain control of the power plant system through separate output signal isolators (not shown). Under normal conditions, output functions 48 and 68 send substantially the same data to steering circuit 82, designated as the switch in FIG. Under normal operating conditions in which the first control system 40 functions properly, the output data from the first output function 48 is provided to the field processing 80.

In both the first control system 40 and the second control system 60, each subsystem is monitored for fault signals by the health monitoring functions 50, 70, respectively. When an abnormal function is detected from either of the health monitoring functions 50 and 70, diagnostic information is provided to the control system monitor. If the health monitoring function 50, 70 receives an abnormal function signal from any subcomponent that affects the successful operation of the first control system 40, the health monitoring function 50, 70 receives the first system 40. Provide a signal to the steering switch 82 to switch the output flow from the back to the second system (60). The health monitoring function also provides diagnostic information about each control system, including warnings, indications of health conditions, and fault detection, to improve system maintenance and repair the control system. Mean Time To Repair). The known manual switching function 86 also permits manual override of the control system as needed and permits manual activity of the power plant system, so that maintenance does not interrupt the normal power generation operation. Allows any of the second systems to be performed. In this way, changes in programming or other control processing can be implemented without system downtime. As shown in FIG. 3, the design of a control system capable of withstanding defects ensures that the normal operation of the control system is not affected by the defect of a single component without the control system.

In operation, both the first control system 40 and the second control system 60 are in parallel and operate in real time. Therefore, under normal operating conditions and in the absence of an abnormal function of the system, the outputs 48 and 68 are substantially the same. As a result, switching from the first system 40 to the second system 60 on receipt of the abnormal function signal from the first system 40 will not substantially affect the field processing 80.

The flowchart of the control system digital schematic diagram shown in FIG. 3A is similar in configuration to the flowchart of the control system analog schematic diagram of FIG. 3. However, the digital configuration does not include the steering circuit 82. Rather, both the first and second control systems of FIG. 3A additionally include selection circuits 90 and 92, respectively. During normal operation, substantially the same outputs 94 and 96 are provided continuously to the field device 80 and in parallel with both the first and second control systems. If the health monitoring circuit 50 in the first control system 40 detects a defect in the first control system, the selection circuit 90 causes the output 94 to stop without affecting the output 96. Interruption of the output 94 does not completely affect the field device 80 because the output 96 is maintained. In a preferred embodiment, only the output 94 from the first control system can be stopped. However, when a fault in one of the control systems is detected, the first and second control systems 40 and 60 are exactly the same while allowing the interruption of either the first output 94 or the second output 96. It is possible to design a control system that can withstand faults.

A control system capable of withstanding the deficiencies of the present invention eliminates the deficiencies of certain single point systems that occur in common. In fact, single point defects in the system are substantially eliminated. The control system design uses redundant processors, input / output and communication means that each of the subsystems eliminates single point faults in the redundant control system. The control task is automatically transferred from the first control processor unit to the second control processor unit when a defect is detected in the first unit. Control is transferred to the backup unit in a seamless manner that does not affect the online processing. As a result, the likelihood of faulty individual components adversely affecting plant operation is minimized and quantified due to improved average time between faults for these control systems (MTBF). Thus, complex transients are much less likely to occur due to faulty control systems, and overall plant performance is increased due to higher system availability.

Preferred embodiments of the invention have been disclosed. However, those skilled in the art will recognize certain modifications and other forms that can occur within the description of the invention. Therefore, the following claims should be considered to determine the scope and content of the present invention.

Claims (16)

In a fault tolerant control system, which is able to withstand faults controlling a field device, 1. A substantially identical first and second control system comprising substantially the same input function, substantially the same output function and substantially the same processing function, wherein the first control system provides a health monitor for each of the first functions. a first control system and a second control system; Means for transferring control of the field device from the first control system to the second control system. The control system of claim 1, wherein said first and second control systems provide an analog output. 3. A control system according to claim 2, wherein said control transfer means comprises a switch inserted between said output function and said field device controlled by said control system, so that only when said health monitor indicates that said first control system is malfunctioning. And to cause the switch to couple the second control system output function to the field device. 3. A control system as claimed in claim 2, wherein said second control system comprises a second health signal from each of said second functions. 5. The control system of claim 4, wherein the first and second health signals are continuously monitored. 6. The control system of claim 5 wherein the switch is provided with a manual switching function to selectively allow manual transfer of the motion control system from the first and second control systems. 7. The control system of claim 6, wherein the first and second control systems provide real time data extraction. The control system of claim 1, wherein said first and second control systems provide real-time data extraction. 2. The control system of claim 1 wherein the switch is provided with a passive switching function to selectively allow manual transfer of the motion control system from the first and second control systems. 2. The control system of claim 1 wherein both the first and second control systems provide substantially the same digital output in parallel with the field device. 11. The apparatus of claim 10, wherein said control transfer means comprises a selection circuit inserted between said digital output controlled by said control system and said field device, such that said health monitor indicates that said first control system is malfunctioning. Only when the selection circuitry stops the first digital output. 12. The control system of claim 11, wherein said second control system includes a second health signal from each of said second functions. 13. The second control system of claim 12, wherein the second control system comprises a selection circuit inserted between the second digital output and the field device controlled by the control system, such that the health monitor has an abnormal function of the second control system. And the selection circuitry stops the second digital output only when indicating. The control system of claim 13, wherein the first and second health signals are continuously monitored. 14. The control system of claim 13 wherein the digital output is provided with a passive switching function to selectively allow the transfer of the control system from the first and second control systems. 16. The control system of claim 15, wherein the first and second control systems provide real time data extraction.